diff --git a/lang/swi-prolog/patches/patch-packages_xpce_src_img_gifread_c b/lang/swi-prolog/patches/patch-packages_xpce_src_img_gifread_c index 4f077d769e4..4ff9b2ad3a2 100644 --- a/lang/swi-prolog/patches/patch-packages_xpce_src_img_gifread_c +++ b/lang/swi-prolog/patches/patch-packages_xpce_src_img_gifread_c @@ -1,4 +1,4 @@ -$OpenBSD: patch-packages_xpce_src_img_gifread_c,v 1.1 2011/09/15 15:36:54 jasper Exp $ +$OpenBSD: patch-packages_xpce_src_img_gifread_c,v 1.2 2011/09/16 10:42:58 jasper Exp $ From bb328029beb148691edc031d9db9cf0a503c8247 Mon Sep 17 00:00:00 2001 From: Jan Wielemaker @@ -10,8 +10,17 @@ From: Jan Wielemaker Date: Thu, 18 Aug 2011 16:26:44 +0200 Subject: [PATCH] SECURITY: Bug#7: More gif-read fixes. ---- packages/xpce/src/img/gifread.c.orig Wed Sep 14 21:46:22 2011 -+++ packages/xpce/src/img/gifread.c Wed Sep 14 21:46:43 2011 +--- packages/xpce/src/img/gifread.c.orig Fri Sep 16 12:42:34 2011 ++++ packages/xpce/src/img/gifread.c Fri Sep 16 12:42:32 2011 +@@ -169,7 +169,7 @@ GIFReadFD(IOSTREAM *fd, + /* read colormaps */ + if ( BitSet((UCHAR) buf[4], LOCALCOLORMAP) ) + { if ( (rval=ReadColorMap(fd, GifScreen.BitPixel, at, ac, closure)) +- != GIF_OK ) ++ != GIF_OK ) + { setGifError("Error reading GIF colormap"); + return rval; + } @@ -466,7 +466,7 @@ LZWReadByte(IOSTREAM * fd, int flag, int input_code_si firstcode = oldcode = GetCode(fd, code_size, FALSE); } @@ -21,12 +30,29 @@ Subject: [PATCH] SECURITY: Bug#7: More gif-read fixes. } if (sp > stack) return *--sp; -@@ -505,11 +505,11 @@ LZWReadByte(IOSTREAM * fd, int flag, int input_code_si +@@ -487,11 +487,11 @@ LZWReadByte(IOSTREAM * fd, int flag, int input_code_si + max_code = clear_code + 2; + sp = stack; + firstcode = oldcode = GetCode(fd, code_size, FALSE); +- return firstcode; +- } else if (code == end_code) ++ return (firstcode&255); ++ } else if (code == end_code || code > max_code) + { + int count; +- UCHAR buf[260]; ++ UCHAR buf[260]; /* Block buffer */ + + if (ZeroDataBlock) + return -2; +@@ -504,12 +504,12 @@ LZWReadByte(IOSTREAM * fd, int flag, int input_code_si + } incode = code; - if (code == max_code) +- if (code >= max_code) - { - *sp++ = firstcode; ++ if (code == max_code) + { if ( sp < stack+sizeof(stack) ) /* stack is UCHAR */ + *sp++ = firstcode; code = oldcode; @@ -46,3 +72,15 @@ Subject: [PATCH] SECURITY: Bug#7: More gif-read fixes. if ((code = max_code) < (1 << MAX_LZW_BITS)) { +@@ -537,9 +538,9 @@ LZWReadByte(IOSTREAM * fd, int flag, int input_code_si + oldcode = incode; + + if (sp > stack) +- return *--sp; ++ return ((*--sp) & 255); + } +- return code; ++ return (code&255); + } + +